CVE-2018-20796
First published: Tue Feb 26 2019(Updated: )
In the GNU C Library (aka glibc or libc6) through 2.29, check_dst_limits_calc_pos_1 in posix/regexec.c has Uncontrolled Recursion, as demonstrated by '(\227|)(\\1\\1|t1|\\\2537)+' in grep.
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| GNU glibc | <=2.29 | |
| Netapp Cloud Backup | ||
| NetApp ONTAP Select Deploy administration utility | ||
| Netapp Steelstore Cloud Integrated Storage |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.securityfocus.com/bid/107160
- https://debbugs.gnu.org/cgi/bugreport.cgi?bug=34141
- https://lists.gnu.org/archive/html/bug-gnulib/2019-01/msg00108.html
- https://security.netapp.com/advisory/ntap-20190315-0002/
- https://support.f5.com/csp/article/K26346590?utm_source=f5support&utm_medium=RSS
- https://support.f5.com/csp/article/K26346590?utm_source=f5support&%3Butm_medium=RSS
Frequently Asked Questions
What is CVE-2018-20796?
CVE-2018-20796 is a vulnerability in the GNU C Library (glibc) through version 2.29 that allows for uncontrolled recursion, leading to potential denial of service or arbitrary code execution.
How does CVE-2018-20796 impact affected systems?
CVE-2018-20796 can affect systems that rely on the affected versions of the GNU C Library (glibc), potentially leading to denial of service or arbitrary code execution.
What is the severity of CVE-2018-20796?
CVE-2018-20796 has a severity rating of 7.5 (high).
Which software versions are affected by CVE-2018-20796?
Versions of GNU glibc up to and including 2.29, NetApp Cloud Backup, NetApp ONTAP Select Deploy administration utility, and NetApp Steelstore Cloud Integrated Storage are affected by CVE-2018-20796.
How can I mitigate or fix CVE-2018-20796?
To mitigate CVE-2018-20796, it is recommended to upgrade to a patched version of the GNU C Library (glibc), if available, or follow the guidance provided by the software vendor for the affected software.
- collector/nvd-index
- agent/references
- agent/weakness
- agent/author
- agent/type
- agent/event
- agent/severity
- agent/description
- agent/remedy
- agent/softwarecombine
- agent/first-publish-date
- agent/last-modified-date
- agent/tags
- collector/mitre-cve
- source/MITRE
- vendor/gnu
- canonical/gnu glibc
- version/gnu glibc/2.29
- vendor/netapp
- canonical/netapp cloud backup
- canonical/netapp ontap select deploy administration utility
- canonical/netapp steelstore cloud integrated storage